Carbonite v1.0 is an LKM that is designed to investigate and detect rootkits. Carbonite even works with LKM rootkits that patch calls to /proc. It works like lsof and ps at the kernel level, querying every process in Linux's task_struct, which is the kernel structure that maintains information on every running process in Linux. It gives administrators a more reliable method to identify all running processes on the system.
